Crude, major help

Shadow_Puter_Dude · Jul 29, 2006

Run HijackThis. Click the 'Do a system scan only' button. Place a checkmark in the box next to the following lines:

O2 - BHO: Ozbyq Class - {D623BC2F-A58D-4A75-A10D-CC244A702A35} - C:\WINDOWS\system32\xeymi.dll (file missing)
O4 - HKCU\..\Run: [cuhbd] C:\WINDOWS\system32\ggvicp.exe reg_run
Click to expand...

Click on the 'Fix checked' button. Wait for HijackThis to finish; close HijackThis

Now run Pocket Killbox:

Choose Tools -> Delete Temp Files and click the RED X.

Run Killbox.exe. Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot. Note many of the file list below may not exist but we need to check for them anyway.

C:\WINDOWS\system32\ggvicp.exe
Click to expand...

If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

Now boot into SAFE MODE

Open ExplorerXP navigate to and DELETE the following: (Some of these may have already been deleted by Pocket Killbox)

C:\WINDOWS\system32\ggvicp.exe <<=== Delete the File
Click to expand...

Now run CCleaner. If you have Windows XP delete the contents of C:\WINDOWS\Prefetch.

Then, as an added precaution, Go to Start -> Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.

REBOOT to Normal Mode.

Post a fresh HijackThis log.

How is your computer running?

RE2LeonS · Jul 29, 2006

Its running sort of slow, its taking almost 5 minutes just to start and load my desktop and there are these very odd back drop shadows on my desktop icon's. And just this very second I got a Microsoft Internet Explorer message saying "NOTICE: If your computer has been running slower than normal, it may be infected with Viruses, Adware or Spyware. Download WinAntiVirus FREE now!" But I know that WinAntiVirus is an actually virus it self so i've just been clicking the red X to get rid of it

Shadow_Puter_Dude · Jul 29, 2006

Most of the infections you had are now gone.

I just noticed that HijackThis is named analyse.exe.exe. Rename to xyz.exe.

<< The installed version of Java on this compter is out-dated. Install version 1.5.0_07 available from http://java.sun.com/javase/downloads/index.jsp. Uninstall all older versions of Java on your computer, before installing the latest version of Java. >>

Follow the directions for running Running WinPfind by OldTimer.

Post WinPFind.txt and a fresh HijackThis log.

RE2LeonS · Jul 29, 2006

All right here are the logs, tell me if i downloaded the right Java

Shadow_Puter_Dude · Jul 29, 2006

You want 1.5.0_07 of Java.

Please remove the extra .exe from the renamed hijackthis.exe.

I'll post a set of instructions shortly.

Shadow_Puter_Dude · Jul 29, 2006

Copy the contents of the below quote box to Notepad; Save As FixReg.reg to your Desktop. DO NOT run it as this time we will do that later in Safe Mode.

REGEDIT4

[-HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CBCC61FA-0221-4ccc-B409-CEE865CACA3A}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]
"{CBCC61FA-0221-4ccc-B409-CEE865CACA3A}"=-

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
"{085828D6-0B75-1033-0805-040203200001}"=-
"{085828D6-0B74-1033-0805-040203200001}"=-
Click to expand...

Close Notepad.

In HJT Choose Open the Misc Tools Section choose Process Manager, Highlight:

C:\DOCUME~1\HP_Owner\LOCALS~1\Temp\mmxsnet.exe
C:\DOCUME~1\HP_Owner\LOCALS~1\Temp\mshtml2.exe
C:\Program Files\Common Files\{085828D6-0B74-1033-0805-040203200001}\Update.exe
Click to expand...

Choose Kill Process

Now Run HijackThis. Click the 'Do a system scan only' button. Place a checkmark in the box next to the following lines:

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://aimtoday.aol.com/today/aimtoday.adp?type=2&product=9&platform=1&channel=283&build=3861&SN=CDPMGNHJEPCAOEGIHMFN&CC=BINOFCEK&PC=HCLEDICABB&segment=-1&UTC=1145932256&LT=1145914256&nlogin=1
O2 - BHO: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll
O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll
Click to expand...

Click on the 'Fix checked' button. Wait for HijackThis to finish; close HijackThis.

Now run Pocket Killbox:

Choose Tools -> Delete Temp Files and click the RED X.

Run Killbox.exe. Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot. Note many of the file list below may not exist but we need to check for them anyway.

C:\DOCUME~1\HP_Owner\LOCALS~1\Temp\mmxsnet.exe
C:\DOCUME~1\HP_Owner\LOCALS~1\Temp\mshtml2.exe
C:\Program Files\HijackThis.exe
C:\Program Files\Common Files\{085828D6-0B74-1033-0805-040203200001}\Update.exe
C:\Program Files\ToolBar888\MyToolBar.dll
C:\WINDOWS\x2.64.exe
C:\WINDOWS\SYSTEM32\spoolsvv.exe
C:\WINDOWS\SYSTEM32\x.264.exe
C:\WINDOWS\SYSTEM32\yv12vfw.dll
Click to expand...

If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

Now boot into SAFE MODE

Locate FixReg.reg on your Desktop. Double-click on it and answer 'Yes' when asked if you want to merge with the registry.

Open ExplorerXP navigate to and DELETE the following: (Some of these may have already been deleted by Pocket Killbox)

C:\DOCUME~1\HP_Owner\LOCALS~1\Temp\mmxsnet.exe <<=== Delete the File
C:\DOCUME~1\HP_Owner\LOCALS~1\Temp\mshtml2.exe <<=== Delete the File
C:\Program Files\HijackThis.exe <<=== Delete the File
C:\Program Files\Common Files\{085828D6-0B74-1033-0805-040203200001} <<=== Delete the Folder
C:\Program Files\ToolBar888 <<=== Delete the Folder
C:\WINDOWS\x2.64.exe <<=== Delete the File
C:\WINDOWS\SYSTEM32\spoolsvv.exe <<=== Delete the File
C:\WINDOWS\SYSTEM32\x.264.exe <<=== Delete the File
C:\WINDOWS\SYSTEM32\yv12vfw.dll <<=== Delete the File
Click to expand...

Now run CCleaner. If you have Windows XP delete the contents of C:\WINDOWS\Prefetch.

Then, as an added precaution, Go to Start -> Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.

REBOOT to Normal Mode.

Post a fresh Hijackthis log.

RE2LeonS · Jul 30, 2006

All right so here's the thing, I don't know what 1.5.0_07 means so I just downloaded JDK 5.0 Update 7 because nothing was named what you said. Now for the HijackThis Process Manager thing, I didn't find these two files in it:

C:\DOCUME~1\HP_Owner\LOCALS~1\Temp\mmxsnet.exe
C:\DOCUME~1\HP_Owner\LOCALS~1\Temp\mshtml2.exe

They may have been deleted yesterday because I ran another AdAware and SpyBot to see if either them could delete the files that they couldn't before.

Here's another HijackThis log, also my desktop icon's still have a werid backdrop shadow and there's this suspicious white dot in the upper left hand corner

Shadow_Puter_Dude · Jul 30, 2006

JDK is the Java Development Kit, but that is OK. The JDK comes with the Java Runtime Environment (JRE) and installs the JRE when you install the JDK.

Your HijackThis log is clean.

1. Open the Control Panel
2. Open Display Properties.
3. Click the Desktop tab.
4. Click the Customize Desktop button.
5. Click the Web tab in the Desktop Items window.

Disable Active Desktop, un-check all checkboxes in this window.

How is your computer running?

RE2LeonS · Jul 30, 2006

I got the WinAntiVirus thing again eariler after I did what you told me to do

Shadow_Puter_Dude · Jul 30, 2006

Follow the directions for:
Running WinPfind by OldTimer
Using GetRunKey
Using ShowNew

Post WinPFind.txt, runkey.txt, newfiles.txt and a fresh HijackThis log. You will need 2 posts, to post all 4 logs.

RE2LeonS · Jul 30, 2006

First Set

RE2LeonS · Jul 30, 2006

and the hijackthis log

Shadow_Puter_Dude · Jul 30, 2006

Run Pocket Killbox:

Choose Tools -> Delete Temp Files and click the RED X.

Run Killbox.exe. Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot. Note many of the file list below may not exist but we need to check for them anyway.

C:\WINDOWS\media_motor_bundle.exe
C:\WINDOWS\MOTA113.exe
C:\WINDOWS\system32\ghynf.exe
C:\WINDOWS\system32\bez6n4r21.exe
C:\WINDOWS\system32\n9nyb.exe
C:\WINDOWS\system32\bez6n4r21.exe
C:\WINDOWS\system32\icon_mediamotor.exe
C:\WINDOWS\system32\iqqr.exe
C:\WINDOWS\system32\ts_mediamotor.exe
C:\WINDOWS\system32\uninstIcn.exe
C:\WINDOWS\system32\wnsapisv.exe
C:\WINDOWS\fbdps.dll
C:\WINDOWS\system32\mscdaux.dll
Click to expand...

If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

Now boot into SAFE MODE

Open ExplorerXP navigate to and DELETE the following: (Some of these may have already been deleted by Pocket Killbox)

C:\WINDOWS\media_motor_bundle.exe <<=== Delete the File
C:\WINDOWS\MOTA113.exe <<=== Delete the File
C:\WINDOWS\system32\ghynf.exe <<=== Delete the File
C:\WINDOWS\system32\bez6n4r21.exe <<=== Delete the File
C:\WINDOWS\system32\n9nyb.exe <<=== Delete the File
C:\WINDOWS\system32\bez6n4r21.exe <<=== Delete the File
C:\WINDOWS\system32\icon_mediamotor.exe <<=== Delete the File
C:\WINDOWS\system32\iqqr.exe <<=== Delete the File
C:\WINDOWS\system32\ts_mediamotor.exe <<=== Delete the File
C:\WINDOWS\system32\uninstIcn.exe <<=== Delete the File
C:\WINDOWS\system32\wnsapisv.exe <<=== Delete the File
C:\WINDOWS\fbdps.dll <<=== Delete the File
C:\WINDOWS\system32\mscdaux.dll <<=== Delete the File
Click to expand...

Now run CCleaner. If you have Windows XP delete the contents of C:\WINDOWS\Prefetch.

Then, as an added precaution, Go to Start -> Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.

REBOOT to Normal Mode.

How is your computer running now?Run Pocket Killbox:

Choose Tools -> Delete Temp Files and click the RED X.

Run Killbox.exe. Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot. Note many of the file list below may not exist but we need to check for them anyway.

C:\WINDOWS\media_motor_bundle.exe
C:\WINDOWS\MOTA113.exe
C:\WINDOWS\system32\ghynf.exe
C:\WINDOWS\system32\bez6n4r21.exe
C:\WINDOWS\system32\n9nyb.exe
C:\WINDOWS\system32\bez6n4r21.exe
C:\WINDOWS\system32\icon_mediamotor.exe
C:\WINDOWS\system32\iqqr.exe
C:\WINDOWS\system32\ts_mediamotor.exe
C:\WINDOWS\system32\uninstIcn.exe
C:\WINDOWS\system32\wnsapisv.exe
C:\WINDOWS\fbdps.dll
C:\WINDOWS\system32\mscdaux.dll
Click to expand...

If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

Now boot into SAFE MODE

Open ExplorerXP navigate to and DELETE the following: (Some of these may have already been deleted by Pocket Killbox)

C:\WINDOWS\media_motor_bundle.exe <<=== Delete the File
C:\WINDOWS\MOTA113.exe <<=== Delete the File
C:\WINDOWS\system32\ghynf.exe <<=== Delete the File
C:\WINDOWS\system32\bez6n4r21.exe <<=== Delete the File
C:\WINDOWS\system32\n9nyb.exe <<=== Delete the File
C:\WINDOWS\system32\bez6n4r21.exe <<=== Delete the File
C:\WINDOWS\system32\icon_mediamotor.exe <<=== Delete the File
C:\WINDOWS\system32\iqqr.exe <<=== Delete the File
C:\WINDOWS\system32\ts_mediamotor.exe <<=== Delete the File
C:\WINDOWS\system32\uninstIcn.exe <<=== Delete the File
C:\WINDOWS\system32\wnsapisv.exe <<=== Delete the File
C:\WINDOWS\fbdps.dll <<=== Delete the File
C:\WINDOWS\system32\mscdaux.dll <<=== Delete the File
Click to expand...

Now run CCleaner. If you have Windows XP delete the contents of C:\WINDOWS\Prefetch.

Then, as an added precaution, Go to Start -> Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.

REBOOT to Normal Mode.

How is your computer running now?

RE2LeonS · Jul 30, 2006

Yeah its starting a lot faster now, but i'm wondering can i delete the CountSpy thing because thats one thing that MAJORLY slows start up because it checks for updates right away

Shadow_Puter_Dude · Jul 30, 2006

Yes, you can uninstall CounterSpy.

Use the system for a bit then come back and tell me how things are working.

RE2LeonS · Jul 30, 2006

all right well i thinke verythign is fine now, i deleted the werid links to my desktop that were check in the Customize Desktop thing, well THANK YOU SOOOOOOOOOOOOOO MUCH for all your help and sorry we didn't even start making progress till liek the 4th page >_< I'm a total moron when it comes to virus's sometimes

Shadow_Puter_Dude · Jul 30, 2006

We're here to help, having a virus or several of them in control of your computer is a frustrating experience.

Lets flush all your restore points and create a new clean one for your system.

Disable And Enable System Restore
How to Protect yourself from malware!

Safe surfing.

Log in or Sign up

Crude, major help

Shadow_Puter_Dude MG Authorized Malware Fighter

RE2LeonS Private First Class

Attached Files:

hijackthis.log

Shadow_Puter_Dude MG Authorized Malware Fighter

RE2LeonS Private First Class

Attached Files:

WinPFind.Txt

hijackthis.log

Shadow_Puter_Dude MG Authorized Malware Fighter

Shadow_Puter_Dude MG Authorized Malware Fighter

RE2LeonS Private First Class

Attached Files:

hijackthis.log

Shadow_Puter_Dude MG Authorized Malware Fighter

RE2LeonS Private First Class

Shadow_Puter_Dude MG Authorized Malware Fighter

RE2LeonS Private First Class

Attached Files:

runkeys.txt

WinPFind.Txt

newfiles.txt

RE2LeonS Private First Class

Attached Files:

hijackthis.log

Shadow_Puter_Dude MG Authorized Malware Fighter

RE2LeonS Private First Class

Shadow_Puter_Dude MG Authorized Malware Fighter

RE2LeonS Private First Class

Shadow_Puter_Dude MG Authorized Malware Fighter